Reference / Printable checklists
Keep the failure cases close.
Compact, actionable review lists. Download Markdown copies or use your browser's Print to PDF. They are reference checklists, not security certifications.
Reference 1/3
Mobile device trust checklist
A one-page review for App Attest, Play Integrity and resource authorization.
- Name the protected server action and the attacker-controlled inputs.
- Validate platform evidence through vendor-specific server verification.
- Bind proof to the intended action and its expected application identity.
- Enforce challenge freshness/replay semantics appropriate to the API mode.
- Authenticate the principal independently of device evidence.
- Authorize this principal's action on the requested resource.
- Apply a risk-specific outage policy and preserve failure observability.
Reference 2/3
Safe API retry checklist
Decide whether an ambiguous HTTP mutation can safely be retried.
- Treat client timeouts as unknown remote outcomes, not rollbacks.
- Use one idempotency key per logical operation and reuse it on retries.
- Scope deduplication to the authenticated tenant and request fingerprint.
- Make operation claims atomic across workers.
- Limit retries with deadlines, jitter and error classification.
- Persist/reconcile terminal results and test crash boundaries.
- Do not retry deterministic authorization or validation failures.
Reference 3/3
Session & recovery review checklist
Audit step-up, session refresh, revocation, and logging without creating bypasses.
- Separate authenticated, access-expired, revoked and recovery-pending states.
- Validate refresh credentials using server-managed records.
- Consume and rotate single-use credentials atomically.
- Never let a local UI signal mint a server session on its own.
- Require independent evidence for recovery and sensitive step-up.
- Rate-limit abuse paths and invalidate old sessions after recovery.
- Log stable outcomes, never raw tokens, passwords or recovery codes.
Verify the linked current vendor guidance before applying a checklist to production systems. The download contains plain Markdown and no executable content.